6.6Authorization in GraphQL

def test_graphql_unauthorized_field(viewer_api, base_url):
    """Viewer should not be able to query admin-only fields."""
    query = """
    query {
        user(id: "123") {
            name
            email
            internalNotes  # admin-only field
        }
    }
    """
    r = requests.post(f"{base_url}/graphql",
        json={"query": query},
        headers=viewer_api.headers)

    data = r.json()
    # Either errors or null for the restricted field
    if "errors" not in data:
        assert data["data"]["user"]["internalNotes"] is None